hxxp://vo[.]bo/

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://vo.bo/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	firefox.exe
Token: SeDebugPrivilege	1200	firefox.exe
Token: SeDebugPrivilege	1200	firefox.exe
Token: SeDebugPrivilege	1200	firefox.exe
Token: SeDebugPrivilege	1200	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1200	firefox.exe
1200	firefox.exe
1200	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1200	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1960 wrote to memory of 1200	1960	firefox.exe	14
PID 1200 wrote to memory of 4396	1200	firefox.exe	18
PID 1200 wrote to memory of 4396	1200	firefox.exe	18
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 4388	1200	firefox.exe	20
PID 1200 wrote to memory of 684	1200	firefox.exe	31
PID 1200 wrote to memory of 684	1200	firefox.exe	31
PID 1200 wrote to memory of 684	1200	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://vo.bo/
1⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1200.0.17603863\1299397007" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a41206f-3810-40e0-8906-c69cb1a4cb11} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" 1980 1ade27e8458 gpu
  2⤵
  PID:4396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1200.1.574302602\890866913" -parentBuildID 20221007134813 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {74a776ff-6224-4bd4-9b81-fc1e0067eb80} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" 2404 1add5c6fb58 socket
  2⤵
  PID:4388
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1200.2.1956294327\1278932379" -childID 1 -isForBrowser -prefsHandle 3320 -prefMapHandle 3316 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5005bf6c-8be4-4715-87f6-569f5e31441a} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" 3172 1ade67e3f58 tab
  2⤵
  PID:684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1200.3.257094624\894300397" -childID 2 -isForBrowser -prefsHandle 3888 -prefMapHandle 3884 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dde0d620-ab5c-43d2-912e-8055e5d57f96} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" 3900 1add5c61f58 tab
  2⤵
  PID:4160
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1200.6.889598954\1283057458" -childID 5 -isForBrowser -prefsHandle 5324 -prefMapHandle 5328 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ecf4fb6-e44b-4c5d-9cde-a8c0fda63413} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" 5312 1ade88a5758 tab
  2⤵
  PID:3900
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1200.5.1643495896\280566773" -childID 4 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8763fba7-abf5-4f30-b731-516be89bd558} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" 5128 1ade88a6c58 tab
  2⤵
  PID:3192
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1200.4.736669292\1642996421" -childID 3 -isForBrowser -prefsHandle 4968 -prefMapHandle 4976 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4714920-87bb-4b75-8122-030acd2b9334} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" 4988 1ade88a7b58 tab
  2⤵
  PID:2760

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://vo.bo/"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g5azq69j.default-release\cache2\entries\B573808F9B4F64D3E5F0B069BDAA48EF4086E712

Filesize
13KB

MD5
5b72d88905843132975540dfd72f87d4

SHA1
a74df555239e7e9cfe175fa9a755469c2299ebd0

SHA256
7948c97129ceeec140aaf5024fc2a06992ebdbb258aab4a6a18759f26c90159f

SHA512
321a7a7b655c36b6c7290d9b782f3c43e37ff0d19fc41594d808ec977abfcddb08faaea123baffbe2cb2e77f1e6ff39770d9b8ca5544b6e92424881fd27b5a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
2.1MB

MD5
e4834f24346a09df3ba9b795f45d5a5e

SHA1
15ad8e2495706d12164a251f01ff90e2aa72cc0d

SHA256
8b0b63cd95321142389e81fdbf3c050bbaee5ee3bf63ecf898a20d136bf8cf81

SHA512
d1be7d76f435337532cfa61445defdd156d5575900f81f2cd223ce805eae5abee34b09afcd65b95a5f45501e8a4c89e34c62d0ba3f5f7351fa582d1b59554e59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
650b5d9074598c912d3278fbde640714

SHA1
753cd4a74f97eba814f52ff806ccb07c717a9b1e

SHA256
589dda45c08ea3af648028112742758c83970e730abbd370eb2e571be6a794c3

SHA512
9bcc616e3eebf4a3ea55700324402c80073eae34e0140c9a0cbe73a7b93ea2a3981cf0caf86a7e8cff21ea1a2ef9e74008486397ee4249d63830230bd2409c89

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\datareporting\glean\pending_pings\7d5c8f83-5d81-49ab-918d-d8d14db3efda

Filesize
734B

MD5
7273962b42f0a118600e543940550c1d

SHA1
944937a695f5e83c13276c00c849db532954d588

SHA256
e596d66808fddf8a2c840212225f34834eb642bac3a5b0ac8defed22f748ee4e

SHA512
82c7e0ffac869b34333566e78204c466234bf0c448594042c3c9dce583a42e97656d405cfda9d703c90d1069b724926bc12aa1de2a029afcc01c84deadc9d494

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
213KB

MD5
bbfc102f2c3461e54b1cfea656961a18

SHA1
1ceeee8d739e10bd3f669dffd7f815588e1431cc

SHA256
1c754200196ad2f977584d063b4acb20a48c5d8818ec6ff4a3b73bfbfb468220

SHA512
e56305bcc0250aa2461b0921d0781b4612a039cef5562b6549ee50ee60db812516c15c537c284e71743bebdbc019d3b5f4e70cd02339f5097400a40b89f9cdd7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
3.4MB

MD5
ccc849f8444ddd3671d319e232577927

SHA1
44d36b6fdaff275891b40c1e135c55a61478a827

SHA256
7dc5af7512f0f3586e94af055584d2a7c78d87a6b3e5605ef95aa0abcb480499

SHA512
90d477feca70fb1276a088b056cc53667beeae68587723cf641e6f86f67465e0e1b90853894ca01cc276cfe6036cfc2749c99cd50ac6b385dd01d351877bc435

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs-1.js

Filesize
6KB

MD5
daf67825581fa9346190283e1ea41bca

SHA1
14ac1b03a9636616a4da1191574db0aabb3ac45d

SHA256
1fb795d942d2c1d808aca2280579ed5f7e4bd5ac4cca7549dae4b2947f94fccc

SHA512
73d851410ef43e8344846ef40850ed5f700cd2c3a7c660e47ad74611602cc3702679917c67cb56f181ede64337cc824ec3816965ac07a7519ce114826160255f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\prefs-1.js

Filesize
9KB

MD5
c33779a012517281d7be2fa718ac61c3

SHA1
223281b9f7d1661f0bc869225b6f316446f9615f

SHA256
141f0c688514c7e05bf36b8049bc443834c34324c49e824e3801092c2e6f9809

SHA512
d8c5eff8f3ebb4e08a36ff6e2fb88a090ec35d5ac9ed225201e135a05e47efc7e6091c13122afda79f9ec95261025ac292c940093b68f92041ab1be27eb2b32b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
45f00f4b7c115371d3348aa5295e2bec

SHA1
7d6ca27f87389800a63b23b8501431c0cf38df3a

SHA256
b460a20b540cb35df7986d228ef0782ec8a2d14a458175df67bdd527f17e2afe

SHA512
18de24abf4c974bddc615c242a5947f7399cdaf3ddc9b4948be6873056f0ee284c128638d477f9767356f8036caedeb585e232036a416b148a5d62e451d2b879

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
1.4MB

MD5
d0159dec49f36f3baa73938b4f4dde19

SHA1
922e92bcc3781c7c16e1fba585088e124b928a40

SHA256
1ea91f312bd98b12153bce499de80d5600b1ecfbdae170d428671d822d6d61ae

SHA512
54574fd3e1e218e0abdc9ddb04b1787e679ab6b2055523a4204cabad466ec8ada8696f35d83a79b49d902f514a197c976de5e0ec78878c387043e383c1530231

Download Submit